[ CVE-2026-116746 · Published 26 Oct 2026 ]
Vulnerability in qloapps
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/Qloapps/QloApps
- github.com/Qloapps/QloApps/blob/v1.7.0/modules/qlohotelreview/controllers/front/default…
- github.com/Qloapps/QloApps/commit/d5ce1333c99b9619fc17412580fbb28c02be2580
- github.com/Qloapps/QloApps/pull/1757
- www.vulncheck.com/advisories/qloapps-1.6.0-through-1.7.0-unauthorized-hotel-review-subm…